Mozilla Observatory Recommendations

[hkamran80]

General

• Look into HTTP Public Key Pinning
• Add Subresource Integrity

Content Security Policy

• Block inline styles by not allowing 'unsafe-inline' inside style-src
  • Currently conflicts with Tailwind CSS
• Clickjacking protection, using frame-ancestors
• Deny by default, using default-src 'none'
• Restricts use of the <base> tag by using base-uri 'none', base-uri 'self', or specific origins
• Restricts where <form> contents may be submitted by using form-action 'none', form-action 'self', or specific URIs
• Uses CSP3's 'strict-dynamic' directive to allow dynamic script loading

Scan Results